Communication networks have migrated from using specialized networking equipment executing on dedicated hardware, like routers, firewalls, and gateways, to software defined networks (SDNs) executing as virtualized network functions (VNF) in a cloud infrastructure. To provide a service, a set of VNFs may be instantiated on the general purpose hardware. Each VNF may require one or more virtual machines (VMs) to be instantiated. In turn, VMs may require various resources, such as memory, virtual central processing units (vCPUs), and virtual network interfaces or virtual network interface cards (vNICs). Cloud systems are complex multi-layer hardware and software systems that consist of multiple services and components, interacting with each other through complicated mechanisms. For example, OpenStack clouds may include: 1) multiple services, such as nova, neutron, cinder, swift, glance, heat, and keystone, and 2) multiple components, such as servers, virtual machines, volumes, networks and their interfaces. The operation and management of a large-scale cloud is highly susceptible to anomalies, attacks, and faults. Identifying the root causes is often difficult to diagnose even with the skilled operators. This disclosure is directed to addressing issues in the existing technology.